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NRS AUDIT AND RISK COMMITTEE MEETING 
28 May 2019 
1/G/8, Ladywell House, Edinburgh 


Present: 

Colin Ledlie Non-Executive Director (Chair) 
Bill Matthews Non-Executive Director 

Asif Haseeb Audit Scotland, External Auditor 


Dougie Shepherd Scottish Government, Internal Auditor 
Lorraine Twyford Scottish Government, Internal Auditor 


Paul Lowe NRS, Chief Executive 

Linda Sinclair NRS, Director of Strategy & Business Services (Accountable 
Officer) 

Amy Wilson NRS, Director of Statistical & Registration Services 


Anna Krakowska NRS Head of Strategy & Planning 
Steven Hanlon NRS, Chief Financial Officer 
Shirley Cameron NRS Governance Administration (secretariat) 


Apologies: 

Jonny Steen Audit Scotland, External Auditor 

Mandy Gallacher Non-Executive Director 

1. Welcome, Introductions and Declaration of Interests 

1.1 The Chair welcomed everyone to the meeting. Dougie Shepherd was attending 
his first meeting as Internal Audit lead and would replace Myra Binnie going forward. 
The Committee noted their thanks to Myra for her service and support. The meeting 
was also observed by a trainee from Internal Audit. 

1.2 Apologies were noted from Mandy Gallacher and Jonny Steen. 

1.3. No new Declarations of Interest were noted. 


2. Minutes and Actions 


2.1 The minutes of 28 February 2019 were accepted. The minutes would be 
published on the NRS Website Governance page. 


2.2 An action to share the Executive Management Board Forward Look with ARC 
would be included with the papers for information at the next meeting. All other actions 
were closed as completed. 


3. NRS Update Report 

3.1 Paul Lowe (PL) reflected on activity since the last meeting. Priorities and focus 
had been on the 2021 Census Programme and 2019 Rehearsal with assurance 
activity continuing. Finance activity had included the Annual Report as well as end of 
year budget closedown and budget setting for financial year 2019-2020. Activity had 
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also centred around estates, health & safety and archival storage planning in 
collaboration with the Scottish Government. 


4. NRS Governance Report 


4.1 Anna Krakowska presented the report, inviting comments the following topics 
were raised: 
e Business planning. 2018-2019 end of year closing statement were in place and 
would be circulated to members for their interest. 
e Housekeeping arrangements for system access procedures to ensure access 
restrictions following staff leaving NRS. 
e NRS Workforce Planning Review implementation would be taken forward by 
NRS HR colleagues following a change in resource capacity. 


Action A01/19: Business Plan 2018-2019 final closing statements to be shared with 
ARC members. Owner: Anna Krakowska 


5. Census Deep Dive follow-up report 


5.1 Amy Wilson provided the Committee with an update on the programme status. 
The presentation included: 

e Programme Overview — indicating the programme status as red and 
highlighting action to re-plan and re-scope the rehearsal approach. A 
corporate risk was being escalated to Scottish Government (SG), DG 
Economy Assurance Committee recommending inclusion on the SG 
Corporate Risk Register. 

e Scottish Ministers had agreed to fund a reported pressure in 2019-2020, taking 
the budget to £18.6m for the financial year 2019-2020. 

e An outline of the proposed rehearsal period approach, starting in October 
2019, in phases. Phases included Release one and Release two with further 
testing approach being scoped for the Census Programme Board to consider. 

e Scope of rehearsal release one. 

e An overview of recent and forthcoming assurance activities. The next being a 
Gateway) review in July 2019 , followed by an OCIO Technical Assurance 
Framework Delivery Gate in September 2019. 


5.2 |The Committee discussed the presentation as follows: 

e Escalation of risk to Scottish Government. 

e The budget impact in relation to the changed scope and plans for rehearsal had 
still to be fully evaluated. 

e Expectation that delivery of a re-scoped rehearsal would continue to be 
reported and challenged at ARC as well as the Strategic Board. 

e Resource to drive programme change implementation and delivery was being 
considered with options for sourcing being researched. 

e The rehearsal provided a valuable opportunity to learn with the ultimate delivery 
priority of the Census in 2021 . 
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The rehearsal date 13 October 2019 would be the same across the UK. 
Engagement with other Census authorities continued, including a quarterly UK 
Census Committee meeting where all UK authorities were invited to attend and 
contribute. 

ARC requirements for assurance and how that could be achieved were 
discussed. ARC members were invited to consider topics where deeper 
analysis would provide assurance they required. 


NRS Assurance activities 


Anna Krakowska presented the report which provided a summary of assurance 


activity across NRS which had happened in addition to Internal Audit and Audit 
Scotland led audits. The Committee discussed the report as follows: 


Period of Cyber Essentials certification to be provided to ARC members. 
Further detail of the recommendations arising from the reports, would help to 
inform assurance for ARC. 

The Committee suggested the development of an assurance map would 
identify assurance coverage as well as identify gaps in assurance. This was 
already being considered internally. 


Action A02/19: Cyber Essential Certification: Provide ARC members with the period 
of certification achieved. Owner: Anna Krakowska 


Action A03/19: NRS Assurance activities: summary of recommendations arising. 
Owner: Action Anna Krakowska 


Action A04/19: Assurance map: to be developed. Owner: Anna Krakowska 


7. 


7.1 


NRS Risk Deep Dive Topics 


Linda Sinclair presented the report which provided ARC with information on the 


deep dive topics covered to date. The Committee were invited to suggest further topics 
for consideration and these were highlighted as follows: 


Customer services excellence 
Cyber 

Key performance indicators 
Records management. 
Commercial activities 

Data risks 

Fraud 

Budget planning 


LS would work with the Chair and Secretariat to schedule reports into the forward 
agenda plan as described. 


8. 


NRS 2018-2019 Financial Report 
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8.1 Steven Hanlon presented the report which asked members to note the 
provisional budget outturn for 2018/19 and the budget for 2019/20. 


8.2 For 2018-2019 a higher than anticipated income had resulted in an underspend 
position which had enabled NRS to contribute to the wider Scotland reserve. 


8.3 A projected overspend position for 2019/2020 had been accepted with 
measures in place to manage this to balance in-year. 


8.4 The capital budget for 2019/2020 would be managed as a central budget to 
improve oversight of project commitment with delegation to projects as business cases 
were approved. 


8.5 Census budget would amend in-year with the confirmation of Ministerial 
approval of additional funding. This was expected to happen at the appropriate budget 
review point. 


9. NRS Draft Annual Report and Accounts 2018-2019 


9.1 Steven Hanlon introduced the item and invited the Committee to note the first 
draft of the NRS Annual Report and Accounts for 2018/19. The accounts were similar 
in form and content to previous years. 


9.2 SH highlighted to members the inclusion of TUS facility time, reported for the 
first time. Work would continue to refine the report with findings from the audit in July 
2019 by NRS’ external auditors, Audit Scotland, reflected. 


9.3 The accounts for 2018-2019 would be signed by Linda Sinclair, as the 
Accountable Officer once completed. 


10. NRS Audit Recommendations Status Report 


10.1 Anna Krakowska introduced the report and invited comments from the 
Committee. 


10.2 Workforce and succession planning — further consideration to the approach 
across NRS to strengthen controls was on-going. Engagement with wider SG and 
unions was in progress. Previous progress on the target operating model both for 
Census as well as corporately was reflected upon. 


11. Internal Audit Annual Assurance Report 2018-2019 


11.1 Dougie Shepherd introduced the paper and explained that Appendix 1, Census 
Finance Risk Management review was still to be published. 


11.2 Overall and including the outcome of the Census Finance review indicated a 
final Internal Audit opinion of ‘limited assurance’ for 2018-2019 period. The Committee 
discussed this opinion and acknowledged the position had deteriorated from previous 
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years across the scope of the internal audits completed for NRS in the year. The 
opportunity for Internal Audit to provide assurance and to work with NRS to strengthen 
controls had been welcomed by the Accountable Officer. Work would continue through 
action planning to recover the position and drive improvements to controls. 


11.3 The Committee noted the Internal Audit external quality assessment report. 
12. Internal Audit Plan 


12.1 Lorraine Twyford introduced the plan and invited comments from the 
Committee. The plan would provide assurance on NRS Estates, West Register House 
and Thomas Thomson House across the year. Other planned assurance was around 
the NRS Governance approach. Contingency had also been built in for further Census 
assurance if required. 


13. External Audit — Interim Management Report 2019-2019 Final 

13.1 Asif Haseeb presented the paper in a letter format and invited the Committee 
to note the contents. The report informed the Committee that appropriate and effective 
internal controls were in place overall for the key financial systems reviewed. The audit 
testing had identified some areas of improvements to the NRS control environment 
and these were reported. 

14. Draft ARC Annual Report to the NRS Chief Executive. 

14.1 The Chair presented the draft report to the Committee. The draft report would 
be reviewed in line with the assurance reports received from internal and external audit 
reports and would be submitted for consideration at the next meeting. 

Action A05/19: ARC Annual Report: Draft report to be reviewed in line with internal 
and external audit reports and submitted for consideration at the ARC meeting on 5 
September 2019. Owner: Colin Ledlie 

15. Forward Look 

15.1 The report was included for information of the proposed business for the next 
twelve months. Further activity on deep dives would be added to the forward look, 
once agreed. 

16. Date of next meeting 


16.1 The next meeting was planned for 5 September 2019. 


END 
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